9a33ff3deea984165327d7334e3cffa8df23aebcc1d1c0aa144044a52df35421 | Triage

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 09:52

Sharing

Report Analysis Logs

General

Target

appdata/plugins/local_search/local_search.dll
Size

321KB
MD5

328b85d8b7b2ace9dee75eb5f39abbbe
SHA1

6c15fbcd36cbda563293d6a1634b189baa07100f
SHA256

c3700902d8d0b9450170beee9ad1815c322877b57063fbe25134bb6f4fe21a93
SHA512

f5808d268e81d3121e5ea304004b77cc62a70fbbe57617729c2d8d4638671c21467366c0caf078c4a29f9cd89dee190e4555cf45b51cc37f3b014a1b47398e8a
SSDEEP

6144:2zzhw+xRDy8i6uszvwZSZwEi2jJpV90AO7V:E5i6uGvwweiJpV90z

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 3060	2072	rundll32.exe	28
PID 2072 wrote to memory of 3060	2072	rundll32.exe	28
PID 2072 wrote to memory of 3060	2072	rundll32.exe	28
PID 2072 wrote to memory of 3060	2072	rundll32.exe	28
PID 2072 wrote to memory of 3060	2072	rundll32.exe	28
PID 2072 wrote to memory of 3060	2072	rundll32.exe	28
PID 2072 wrote to memory of 3060	2072	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\appdata\plugins\local_search\local_search.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\appdata\plugins\local_search\local_search.dll,#1
  2⤵
  PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads